XffTrustProvider::isIpInRange() - Code Metrics - Inspection of "Allow ipv6 bans + fix ipinrange" - enwikipedia-acc/waca - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — ipv6 ( 5c173f...2a70ad )

by Richard

created 2025-05-09 20:19 UTC

XffTrustProvider::isIpInRange() A

↳ Parent: XffTrustProvider

Complexity

Conditions	5
Paths	3

Size

Total Lines	11
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	1	Features	0

Metric	Value
eloc	6
dl	0
loc	11
rs	9.6111
c	1
b	1
f	0
cc	5
nc	3
nop	3

<?php
/******************************************************************************
 * Wikipedia Account Creation Assistance tool                                 *
 * ACC Development Team. Please see team.json for a list of contributors.     *
 *                                                                            *
 * This is free and unencumbered software released into the public domain.    *
 * Please see LICENSE.md for the full licencing statement.                    *
 ******************************************************************************/

namespace Waca\Providers;

use PDOStatement;
use Waca\PdoDatabase;
use Waca\Providers\Interfaces\IXffTrustProvider;

/**
 * XffTrustProvider short summary.
 *
 * XffTrustProvider description.
 *
 * @version 1.0
 * @author  stwalkerster
 */
class XffTrustProvider implements IXffTrustProvider
{
    /**
     * Array of IP addresses which are TRUSTED proxies
     * @var string[]
     */
    private $trustedCache;
    /**
     * Array of IP addresses which are UNTRUSTED proxies
     * @var string[]
     */
    private $untrustedCache = array();
    /** @var PDOStatement */
    private $trustedQuery;
    /**
     * @var PdoDatabase
     */
    private $database;

    /**
     * Creates a new instance of the trust provider
     *
     * @param string[]    $squidIpList List of IP addresses to pre-approve
     * @param PdoDatabase $database
     */
    public function __construct($squidIpList, PdoDatabase $database)
    {
        $this->trustedCache = $squidIpList;
        $this->database = $database;
    }

    /**
     * Returns a value if the IP address is a trusted proxy
     *
     * @param string $ip
     *
     * @return bool
     */
    public function isTrusted($ip)
    {
        if (in_array($ip, $this->trustedCache)) {
            return true;
        }

        if (in_array($ip, $this->untrustedCache)) {
            return false;
        }

        if ($this->trustedQuery === null) {
            $query = "SELECT COUNT(id) FROM xfftrustcache WHERE ip = :ip;";
            $this->trustedQuery = $this->database->prepare($query);
        }

        $this->trustedQuery->execute(array(":ip" => $ip));
        $result = $this->trustedQuery->fetchColumn();
        $this->trustedQuery->closeCursor();

        if ($result == 0) {
            $this->untrustedCache[] = $ip;

            return false;
        }

        if ($result >= 1) {
            $this->trustedCache[] = $ip;

            return true;
        }

        // something weird has happened if we've got here.
        // default to untrusted.
        return false;
    }

    /**
     * Gets the last trusted IP in the proxy chain.
     *
     * @param string $ip      The IP address from REMOTE_ADDR
     * @param string $proxyIp The contents of the XFF header.
     *
     * @return string Trusted source IP address
     */
    public function getTrustedClientIp($ip, $proxyIp)
    {
        $clientIpAddress = $ip;
        if ($proxyIp) {
            $ipList = explode(",", $proxyIp);
            $ipList[] = $clientIpAddress;
            $ipList = array_reverse($ipList);

            foreach ($ipList as $ipNumber => $ipAddress) {
                if ($this->isTrusted(trim($ipAddress)) && $ipNumber < (count($ipList) - 1)) {
                    continue;
                }

                $clientIpAddress = $ipAddress;
                break;
            }
        }

        return trim($clientIpAddress);
    }

    /**
     * Checks if an IP address is in a range, supporting both IPv4 and IPv6.
     *
     * @param string $low  The lower bound of the range.
     * @param string $high The upper bound of the range.
     * @param string $ip   The IP address to check.
     *
     * @return bool True if the IP is in the range, false otherwise.
     */
    private function isIpInRange($low, $high, $ip)
    {
        $lowBinary = inet_pton($low);
        $highBinary = inet_pton($high);
        $ipBinary = inet_pton($ip);

        if ($lowBinary === false || $highBinary === false || $ipBinary === false) {
            return false; // Invalid IP address
        }

        return strcmp($lowBinary, $ipBinary) <= 0 && strcmp($highBinary, $ipBinary) >= 0;
    }

    /**
     * Takes an array( "low" => "high" ) values, and returns true if $needle is in at least one of them.
     *
     * @param array  $haystack
     * @param string $ip
     *
     * @return bool
     */
    public function ipInRange($haystack, $ip)
    {
        foreach ($haystack as $low => $high) {
            if ($this->isIpInRange($low, $high, $ip)) {
                return true;
            }
        }

        return false;
    }

    /**
     * Explodes a CIDR range into an array of addresses
     *
     * @param string $range A CIDR-format range
     *
     * @return array An array containing every IP address in the range
     */
    public function explodeCidr($range)
    {
        $cidrData = explode('/', $range);

        if (!isset($cidrData[1])) {
            return array($range);
        }

        $blow = (
            str_pad(decbin(ip2long($cidrData[0])), 32, "0", STR_PAD_LEFT) &

            str_pad(str_pad("", $cidrData[1], "1"), 32, "0")
            str_pad(str_pad("", /** @scrutinizer ignore-type */ $cidrData[1], "1"), 32, "0")
        );
        $bhigh = ($blow | str_pad(str_pad("", $cidrData[1], "0"), 32, "1"));


        $list = array();

        $bindecBHigh = bindec($bhigh);
        for ($x = bindec($blow); $x <= $bindecBHigh; $x++) {
            $list[] = long2ip($x);
            $list[] = long2ip(/** @scrutinizer ignore-type */ $x);
        }

        return $list;
    }
}


enwikipedia-acc / waca

Push — ipv6 ( 5c173f...2a70ad )

XffTrustProvider::isIpInRange() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like